-
Notifications
You must be signed in to change notification settings - Fork 68
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* encryption working * now deceryption is working + add support for protection level * added tests for google KMS * added support for KMS in the API * push images temporary from branch * fix image tag
- Loading branch information
Showing
8 changed files
with
247 additions
and
15 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| using System; | ||
| using System.Net; | ||
| using System.Security.Cryptography; | ||
| using System.Text; | ||
| using System.Threading.Tasks; | ||
| using Google; | ||
| using Google.Apis.CloudKMS.v1; | ||
| using Google.Apis.CloudKMS.v1.Data; | ||
| using Microsoft.AspNetCore.WebUtilities; | ||
|
|
||
| namespace Kamus.KeyManagement | ||
| { | ||
| public class GoogleCloudKeyManagment : IKeyManagement | ||
| { | ||
| private readonly CloudKMSService mKmsService; | ||
| private readonly string mProjectName; | ||
| private readonly string mKeyringName; | ||
| private readonly string mKeyringLocation; | ||
| private readonly string mProtectionLevel; | ||
|
|
||
| public GoogleCloudKeyManagment( | ||
| CloudKMSService kmsService, | ||
| string projectName, | ||
| string keyringName, | ||
| string keyringLocation, | ||
| string protectionLevel) | ||
| { | ||
| mKmsService = kmsService; | ||
| mProjectName = projectName; | ||
| mKeyringName = keyringName; | ||
| mKeyringLocation = keyringLocation; | ||
| mProtectionLevel = protectionLevel; | ||
| } | ||
|
|
||
|
|
||
| public async Task<string> Decrypt(string encryptedData, string serviceAccountId) | ||
| { | ||
| var safeId = ComputeKeyId(serviceAccountId); | ||
| var cryptoKeys = mKmsService.Projects.Locations.KeyRings.CryptoKeys; | ||
| var keyringId = $"projects/{mProjectName}/locations/{mKeyringLocation}/keyRings/{mKeyringName}"; | ||
| var keyId = $"{keyringId}/cryptoKeys/{safeId}"; | ||
|
|
||
| var result = await cryptoKeys.Decrypt(new DecryptRequest | ||
| { | ||
| Ciphertext = encryptedData | ||
| }, keyId).ExecuteAsync(); | ||
|
|
||
| return result.Plaintext; | ||
| } | ||
|
|
||
| public async Task<string> Encrypt(string data, string serviceAccountId, bool createKeyIfMissing = true) | ||
| { | ||
| var safeId = ComputeKeyId(serviceAccountId); | ||
| var cryptoKeys = mKmsService.Projects.Locations.KeyRings.CryptoKeys; | ||
| var keyringId = $"projects/{mProjectName}/locations/{mKeyringLocation}/keyRings/{mKeyringName}"; | ||
| var keyId = $"{keyringId}/cryptoKeys/{safeId}"; | ||
| try | ||
| { | ||
| await cryptoKeys.Get(keyId).ExecuteAsync(); | ||
| } catch (GoogleApiException e) when (e.HttpStatusCode == HttpStatusCode.NotFound && createKeyIfMissing) | ||
| { | ||
| //todo: handle key rotation - currently set to never expired | ||
| var key = new CryptoKey | ||
| { | ||
| Purpose = "ENCRYPT_DECRYPT", | ||
| VersionTemplate = new CryptoKeyVersionTemplate | ||
| { | ||
| ProtectionLevel = mProtectionLevel | ||
| } | ||
| }; | ||
|
|
||
| var request = cryptoKeys.Create(key, keyringId); | ||
| request.CryptoKeyId = safeId; | ||
| await request.ExecuteAsync(); | ||
| } | ||
|
|
||
| var encryted = await cryptoKeys.Encrypt(new EncryptRequest | ||
| { | ||
| Plaintext = data | ||
| }, keyId).ExecuteAsync(); | ||
|
|
||
| return encryted.Ciphertext; | ||
| } | ||
|
|
||
| private string ComputeKeyId(string serviceUserName) | ||
| { | ||
| return | ||
| WebEncoders.Base64UrlEncode( | ||
| SHA256.Create().ComputeHash( | ||
| Encoding.UTF8.GetBytes(serviceUserName))) | ||
| .Replace("_", "-"); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| using System; | ||
| using System.IO; | ||
| using System.Threading.Tasks; | ||
| using Google.Apis.Auth.OAuth2; | ||
| using Google.Apis.CloudKMS.v1; | ||
| using Google.Apis.Services; | ||
| using Kamus.KeyManagement; | ||
| using Microsoft.Extensions.Configuration; | ||
| using Xunit; | ||
|
|
||
| namespace integration | ||
| { | ||
| public class GoogleCloudKeyManagmentTests | ||
| { | ||
| private readonly IKeyManagement mGoogleCloudKeyManagement; | ||
| private readonly CloudKMSService mCloudKmsService; | ||
| private readonly IConfiguration mConfiguration; | ||
|
|
||
| public GoogleCloudKeyManagmentTests() | ||
| { | ||
| mConfiguration = new ConfigurationBuilder() | ||
| .AddJsonFile("settings.json") | ||
| .AddEnvironmentVariables().Build(); | ||
|
|
||
| var stream = new MemoryStream(); | ||
| var writer = new StreamWriter(stream); | ||
| writer.Write(mConfiguration.GetValue<string>("KeyManagment:GoogleKms:Credentials")); | ||
| writer.Flush(); | ||
| stream.Position = 0; | ||
| var serviceAccountCredential = ServiceAccountCredential.FromServiceAccountData(stream); | ||
| var credentials = GoogleCredential.FromServiceAccountCredential(serviceAccountCredential); | ||
| if (credentials.IsCreateScopedRequired) | ||
| { | ||
| credentials = credentials.CreateScoped(new[] | ||
| { | ||
| CloudKMSService.Scope.CloudPlatform | ||
| }); | ||
| } | ||
|
|
||
| mCloudKmsService = new CloudKMSService(new BaseClientService.Initializer | ||
| { | ||
| HttpClientInitializer = credentials, | ||
| GZipEnabled = true | ||
| }); | ||
| var location = mConfiguration.GetValue<string>("KeyManagment:GoogleKms:Location"); | ||
| var keyRingName = mConfiguration.GetValue<string>("KeyManagment:GoogleKms:KeyRingName"); | ||
| var protectionLevel = mConfiguration.GetValue<string>("KeyManagment:GoogleKms:ProtectionLevel"); | ||
|
|
||
| mGoogleCloudKeyManagement = new GoogleCloudKeyManagment( | ||
| mCloudKmsService, | ||
| serviceAccountCredential.ProjectId, | ||
| keyRingName, | ||
| location, | ||
| protectionLevel); | ||
| } | ||
|
|
||
|
|
||
|
|
||
| [Fact] | ||
| public async Task TestFullFlow() | ||
| { | ||
| var sa = "sa:namespace"; | ||
| var data = "data"; | ||
| var encrypted = await mGoogleCloudKeyManagement.Encrypt(data, sa); | ||
| var decrypted = await mGoogleCloudKeyManagement.Decrypt(encrypted, sa); | ||
|
|
||
| Assert.Equal(data, decrypted); | ||
|
|
||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters